Espionage CTF - ISSessions 2024

Write by Gabriel S

Cryptography

Sensitive Files

When you open the text file, you can see a random string=0HJfhHMG9FRAJ1eGR1QldWYu9WawNXR, it start with = and has 32 characters, so we reverse it, and then decrypt it with base64 , we can get the flag EspionageCTF{R@D_F0x_$}

The Encryptor

First we see the random string is end with =, so use base64 decrypt and we get

Mediocre cypher skills, you can't break into my maximum security encryption methods, for sure you do not understand this: 59 6F 75 20 65 78 70 65 63 74 65 64 20 79 6F 75 72 20 66 6C 61 67 20 74 6F 20 62 65 20 68 61 6E 64 65 64 20 74 6F 20 79 6F 75 20 6F 6E 20 61 20 73 69 6C 76 65 72 20 70 6C 61 74 65 3F 20 49 20 6B 6E 65 77 20 49 20 63 6F 75 6C 64 20 66 6F 6F 6C 20 79 6F 75 2E 2E 2E 20 79 6F 75 20 77 61 6E 74 20 69 74 3F 20 47 6F 20 67 65 74 20 69 74 3A 20 52 66 63 76 62 61 6E 74 72 50 47 53 7B 51 33 50 45 31 43 47 31 30 41 5F 41 30 30 4F 7D

We can recognize it as Hex, and we get You expected your flag to be handed to you on a silver plate? I knew I could fool you... you want it? Go get it: RfcvbantrPGS{Q3PE1CG10A_A00O}

Data Dump

After looking at aabaa baaab abbba abaaa abbab abbaa aaaaa aabba aabaa aaaba baaba aabab aaabb abbab ababa abbba aabbb abaaa abbaa, use Bacon Cipher Decode to decode it, get ESPIONAGECTFDOLPHIN, and we get the flag EspiongeCTF{DOLPHIN}

The Encryptor 2

TWVkaW9jcmUgY3lwaGVyIHNraWxscywgeW91IGNhbid0IGJyZWFrIGludG8gbXkgbWF4aW11bSBzZWN1cml0eSBlbmNyeXB0aW9uIG1ldGhvZHMsIGZvciBzdXJlIHlvdSBkbyBub3QgdW5kZXJzdGFuZCB0aGlzOgo1OSA2RiA3NSAyMCA2NSA3OCA3MCA2NSA2MyA3NCA2NSA2NCAyMCA3OSA2RiA3NSA3MiAyMCA2NiA2QyA2MSA2NyAyMCA3NCA2RiAyMCA2MiA2NSAyMCA2OCA2MSA2RSA2NCA2NSA2NCAyMCA3NCA2RiAyMCA3OSA2RiA3NSAyMCA2RiA2RSAyMCA2MSAyMCA3MyA2OSA2QyA3NiA2NSA3MiAyMCA3MCA2QyA2MSA3NCA2NSAzRiAyMCA0OSAyMCA2QiA2RSA2NSA3NyAyMCA0OSAyMCA2MyA2RiA3NSA2QyA2NCAyMCA2NiA2RiA2RiA2QyAyMCA3OSA2RiA3NSAyRSAyRSAyRSAyMCA3OSA2RiA3NSAyMCA3NyA2MSA2RSA3NCAyMCA2OSA3NCAzRiAyMCA0NyA2RiAyMCA2NyA2NSA3NCAyMCA2OSA3NCAzQSAyMCA1MiA2NiA2MyA3NiA2MiA2MSA2RSA3NCA3MiA1MCA0NyA1MyA3QiA1MSAzMyA1MCA0NSAzMSA0MyA0NyAzMSAzMCA0MSA1RiA0MSAzMCAzMCA0RiA3RCA=

Because it is end with =, try base64 decode, and get RfcvbantrPGS{Q3PE1CG10A_A00O}, because the format is Espionage, using ROT13 to decode it you can get EspionageCTF{D3CR1PT10N_N00B}

XY_Encryption

After see the graph, I recognize it is Vigenère cipher, so we can check it in the graph, and we get flag EspionageCTF{SHADOW}

Farmers Life

After see the document, we can know it is Rail-fence Cipher, which has four columns, so after decrypt it ,we can get the flagEspionageCTF{SARAHIsAKnownBirdwatcher$}

Forensics

Sketchy

After using the tool to read the QR code, it writes 49sEnm3QqZN18J9YPnjav6UuKuZ8B3rg4gehAa7v,

The hint is bit coin encode, so it is base58, decrypt and get EspionageCTF{Sk$tchy_M@LwArE}

RDP

use online whiteboard to connect the sticker, then we get flag

Programming

Decoy Flag Extraction

grep -oP "EspionageCTF\{[^}]+\}" haystack.txt

then we get flagEspionageCTF{FoundIt!}

Web

Default Dance

In the home page, we can see the login page and the user name of the admin called “SuperDuperCoolAdmin”, And we see the URL, and tried to add /login at the end, when I see the name Shawn, I tried to create a account, and it said default password and try it on admin ,and you get the flag EspionageCTF{bad_passw0rd_policy_smh}

Flight Ops

I try to use burp suite to proxy and change the permission in the header to get the flag

OSINT

PGP

run the command pgp public.txtand we can know the uid is Debra_Spy, the flag is Espionage{Debra_Spy}

Boat Dock

After searching the location on google map, we can see there are many marina near it, measure the distance, we can see only Lax kw’alaams Marina is 44 km away, so the villiage is Lax kw’alaams

Bitcoin Case

After searching the address, we can find RYUK, we know the type is ransomware and belong to RYUK, so the flag is EspionageCTF{ransomware_Ryuk}

Where are you

According to the TD bank and CandyTopia, you can get the street on the Google Map

Totally a virus

Because it is a ransom notes, we can search it on the Virustotal and we can get see the details and get the flagEspionageCTF{Y0u_F0und_M3}

Taxonomy

First, because we get the hint said it use microsoft’s naming method, so we can search it on Google, Microsoft names threat actors, after we see the picture, we can know it is night tsunami, and we can know it is from the NSO Group, and after search it in wiki, we can know the tool is Pegasus, and the flag is `EspionageCTF{Pegasus}